CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2017-5093 – chromium-browser: ui spoofing in blink
https://notcve.org/view.php?id=CVE-2017-5093
Inappropriate implementation in modal dialog handling in Blink in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to prevent a full screen warning from being displayed via a crafted HTML page. Una implementación incorrecta en la manipulación de diálogos modal en Blink en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto evitase que se mostrase una advertencia en pantalla completa mediante una página HTML manipulada. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/550017 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5093 https://bugzilla.redhat.com/show_bug.cgi?id=1475195 • CWE-20: Improper Input Validation CWE-223: Omission of Security-relevant Information •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2017-5106 – chromium-browser: url spoofing in omnibox
https://notcve.org/view.php?id=CVE-2017-5106
Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. La falta de mecanismos suficientes para el cumplimiento de políticas en Omnibox en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto realizase una suplantación de dominio mediante homografías de IDN en un nombre de dominio manipulado. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/714628 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5106 https://bugzilla.redhat.com/show_bug.cgi?id=1475209 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2017-5110 – chromium-browser: ui spoofing in payments dialog
https://notcve.org/view.php?id=CVE-2017-5110
Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page. Una implementación incorrecta de la API de pagos web en las combinaciones blob: y data: en Web Payments en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto suplantase el contenido de Omnibox mediante una página HTML manipulada. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/717476 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5110 https://bugzilla.redhat.com/show_bug.cgi?id=1475213 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2017-5105 – chromium-browser: url spoofing in omnibox
https://notcve.org/view.php?id=CVE-2017-5105
Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name. La falta de mecanismos suficientes para el cumplimiento de políticas en Omnibox en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto realizase una suplantación de dominio mediante homografías de IDN en un nombre de dominio manipulado. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/729979 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5105 https://bugzilla.redhat.com/show_bug.cgi?id=1475208 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 1%CPEs: 9EXPL: 0CVE-2017-5102 – chromium-browser: uninitialized use in skia
https://notcve.org/view.php?id=CVE-2017-5102
Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. El uso de un valor no inicializado en Skia en Google Chrome, en versiones anteriores a la 60.0.3112.78 para Mac, Windows, Linux y Android, permitía que un atacante remoto obtuviese información sensible de la memoria de procesos mediante una página HTML manipulada. • http://www.debian.org/security/2017/dsa-3926 http://www.securityfocus.com/bid/99950 https://access.redhat.com/errata/RHSA-2017:1833 https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html https://crbug.com/727678 https://security.gentoo.org/glsa/201709-15 https://access.redhat.com/security/cve/CVE-2017-5102 https://bugzilla.redhat.com/show_bug.cgi?id=1475204 • CWE-908: Use of Uninitialized Resource •